Skip to content

Commit a0bccf6

Browse files
mattdean3-nhsmattdean3-nhs
committed
[NRL-1922] Re-organise all bucket policies to satistfy sonarqube
1 parent ee7c21e commit a0bccf6

File tree

8 files changed

+175
-106
lines changed

8 files changed

+175
-106
lines changed

‎terraform/account-wide-infrastructure/dev/aws-backup.tf‎

Lines changed: 38 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -3,37 +3,20 @@ resource "aws_s3_bucket" "backup_reports" { # NOSONAR (S6258) - Logging not requ
33
bucket_prefix = "${local.prefix}-backup-reports"
44
}
55

6-
resource "aws_s3_bucket_public_access_block" "backup_reports" {
7-
bucket = aws_s3_bucket.backup_reports.id
8-
9-
block_public_acls = true
10-
block_public_policy = true
11-
ignore_public_acls = true
12-
restrict_public_buckets = true
13-
}
14-
15-
resource "aws_s3_bucket_server_side_encryption_configuration" "backup_reports" {
16-
bucket = aws_s3_bucket.backup_reports.bucket
17-
18-
rule {
19-
apply_server_side_encryption_by_default {
20-
sse_algorithm = "AES256"
21-
}
22-
}
23-
}
24-
25-
resource "aws_s3_bucket_policy" "backup_reports_bucket_policy" {
6+
resource "aws_s3_bucket_policy" "backup_reports_https_only" {
267
bucket = aws_s3_bucket.backup_reports.id
278

289
policy = jsonencode({
2910
Version = "2012-10-17"
30-
Id = "backup_reports_bucket_policy"
11+
Id = "backup_reports_https_only_policy"
3112
Statement = [
3213
{
33-
Sid = "HTTPSOnly"
34-
Effect = "Deny"
35-
Principal = "*"
36-
Action = "s3:*"
14+
Sid = "HTTPSOnly"
15+
Effect = "Deny"
16+
Principal = {
17+
"AWS" : "*"
18+
}
19+
Action = "s3:*"
3720
Resource = [
3821
aws_s3_bucket.backup_reports.arn,
3922
"${aws_s3_bucket.backup_reports.arn}/*",
@@ -43,7 +26,18 @@ resource "aws_s3_bucket_policy" "backup_reports_bucket_policy" {
4326
"aws:SecureTransport" = "false"
4427
}
4528
}
46-
},
29+
}
30+
]
31+
})
32+
}
33+
34+
resource "aws_s3_bucket_policy" "backup_reports_write_access" {
35+
bucket = aws_s3_bucket.backup_reports.id
36+
37+
policy = jsonencode({
38+
Version = "2012-10-17"
39+
Id = "backup_reports_write_access_policy"
40+
Statement = [
4741
{
4842
Sid = "AllowBackupReportsWrite"
4943
Effect = "Allow"
@@ -64,6 +58,24 @@ resource "aws_s3_bucket_policy" "backup_reports_bucket_policy" {
6458
})
6559
}
6660

61+
resource "aws_s3_bucket_public_access_block" "backup_reports" {
62+
bucket = aws_s3_bucket.backup_reports.id
63+
64+
block_public_acls = true
65+
block_public_policy = true
66+
ignore_public_acls = true
67+
restrict_public_buckets = true
68+
}
69+
70+
resource "aws_s3_bucket_server_side_encryption_configuration" "backup_reports" {
71+
bucket = aws_s3_bucket.backup_reports.bucket
72+
73+
rule {
74+
apply_server_side_encryption_by_default {
75+
sse_algorithm = "AES256"
76+
}
77+
}
78+
}
6779

6880
resource "aws_s3_bucket_ownership_controls" "backup_reports" {
6981
bucket = aws_s3_bucket.backup_reports.id

‎terraform/account-wide-infrastructure/modules/athena/s3.tf‎

Lines changed: 15 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,12 @@ resource "aws_s3_bucket" "athena" { # NOSONAR (S6258) - Logging not required for
22
bucket = "${var.name_prefix}-athena"
33
}
44

5-
resource "aws_s3_bucket_policy" "athena" {
6-
bucket = "${var.name_prefix}-athena"
5+
resource "aws_s3_bucket_policy" "athena-https-only" {
6+
bucket = aws_s3_bucket.athena.id
77

88
policy = jsonencode({
99
Version = "2012-10-17"
10-
Id = "athena-policy"
10+
Id = "athena-https-only-policy"
1111
Statement = [
1212
{
1313
Sid = "HTTPSOnly"
@@ -25,7 +25,18 @@ resource "aws_s3_bucket_policy" "athena" {
2525
"aws:SecureTransport" = "false"
2626
}
2727
}
28-
},
28+
}
29+
]
30+
})
31+
}
32+
33+
resource "aws_s3_bucket_policy" "athena-access" {
34+
bucket = aws_s3_bucket.athena.id
35+
36+
policy = jsonencode({
37+
Version = "2012-10-17"
38+
Id = "athena-access-policy"
39+
Statement = [
2940
{
3041
Sid : "AllowAthenaAccess",
3142
Effect : "Allow",

‎terraform/account-wide-infrastructure/modules/glue/s3.tf‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ resource "aws_s3_bucket" "source-data-bucket" { # NOSONAR (S6258) - Logging not
44
}
55

66
resource "aws_s3_bucket_policy" "source-data-bucket" {
7-
bucket = "${var.name_prefix}-source-data-bucket"
7+
bucket = aws_s3_bucket.source-data-bucket.id
88

99
policy = jsonencode({
1010
Version = "2012-10-17"
@@ -79,7 +79,7 @@ resource "aws_s3_bucket" "target-data-bucket" { # NOSONAR (S6258) - Logging not
7979
}
8080

8181
resource "aws_s3_bucket_policy" "target-data-bucket" {
82-
bucket = "${var.name_prefix}-target-data-bucket"
82+
bucket = aws_s3_bucket.target-data-bucket.id
8383

8484
policy = jsonencode({
8585
Version = "2012-10-17"
@@ -132,7 +132,7 @@ resource "aws_s3_bucket" "code-bucket" { # NOSONAR (S6258) - Logging not require
132132
}
133133

134134
resource "aws_s3_bucket_policy" "code-bucket" {
135-
bucket = "${var.name_prefix}-code-bucket"
135+
bucket = aws_s3_bucket.code-bucket.id
136136

137137
policy = jsonencode({
138138
Version = "2012-10-17"

‎terraform/account-wide-infrastructure/modules/permissions-store-bucket/s3.tf‎

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -9,25 +9,6 @@ resource "aws_s3_bucket" "authorization-store" { # NOSONAR (S6258) - Logging not
99
}
1010
}
1111

12-
resource "aws_s3_bucket_public_access_block" "authorization-store-public-access-block" {
13-
bucket = aws_s3_bucket.authorization-store.id
14-
15-
block_public_acls = true
16-
block_public_policy = true
17-
ignore_public_acls = true
18-
restrict_public_buckets = true
19-
}
20-
21-
resource "aws_s3_bucket_server_side_encryption_configuration" "authorization-store" {
22-
bucket = aws_s3_bucket.authorization-store.bucket
23-
24-
rule {
25-
apply_server_side_encryption_by_default {
26-
sse_algorithm = "AES256"
27-
}
28-
}
29-
}
30-
3112
resource "aws_s3_bucket_policy" "authorization_store_bucket_policy" {
3213
bucket = aws_s3_bucket.authorization-store.id
3314

@@ -54,6 +35,25 @@ resource "aws_s3_bucket_policy" "authorization_store_bucket_policy" {
5435
})
5536
}
5637

38+
resource "aws_s3_bucket_public_access_block" "authorization-store-public-access-block" {
39+
bucket = aws_s3_bucket.authorization-store.id
40+
41+
block_public_acls = true
42+
block_public_policy = true
43+
ignore_public_acls = true
44+
restrict_public_buckets = true
45+
}
46+
47+
resource "aws_s3_bucket_server_side_encryption_configuration" "authorization-store" {
48+
bucket = aws_s3_bucket.authorization-store.bucket
49+
50+
rule {
51+
apply_server_side_encryption_by_default {
52+
sse_algorithm = "AES256"
53+
}
54+
}
55+
}
56+
5757
resource "aws_s3_bucket_versioning" "authorization-store" {
5858
bucket = aws_s3_bucket.authorization-store.id
5959
versioning_configuration {

‎terraform/account-wide-infrastructure/prod/aws-backup.tf‎

Lines changed: 32 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -3,31 +3,12 @@ resource "aws_s3_bucket" "backup_reports" { # NOSONAR (S6258) - Logging not requ
33
bucket_prefix = "${local.prefix}-backup-reports"
44
}
55

6-
resource "aws_s3_bucket_public_access_block" "backup_reports" {
7-
bucket = aws_s3_bucket.backup_reports.id
8-
9-
block_public_acls = true
10-
block_public_policy = true
11-
ignore_public_acls = true
12-
restrict_public_buckets = true
13-
}
14-
15-
resource "aws_s3_bucket_server_side_encryption_configuration" "backup_reports" {
16-
bucket = aws_s3_bucket.backup_reports.bucket
17-
18-
rule {
19-
apply_server_side_encryption_by_default {
20-
sse_algorithm = "AES256"
21-
}
22-
}
23-
}
24-
25-
resource "aws_s3_bucket_policy" "backup_reports_bucket_policy" {
6+
resource "aws_s3_bucket_policy" "backup_reports_https_only" {
267
bucket = aws_s3_bucket.backup_reports.id
278

289
policy = jsonencode({
2910
Version = "2012-10-17"
30-
Id = "backup_reports_bucket_policy"
11+
Id = "backup_reports_https_only_policy"
3112
Statement = [
3213
{
3314
Sid = "HTTPSOnly"
@@ -43,7 +24,18 @@ resource "aws_s3_bucket_policy" "backup_reports_bucket_policy" {
4324
"aws:SecureTransport" = "false"
4425
}
4526
}
46-
},
27+
}
28+
]
29+
})
30+
}
31+
32+
resource "aws_s3_bucket_policy" "backup_reports_read_access" {
33+
bucket = aws_s3_bucket.backup_reports.id
34+
35+
policy = jsonencode({
36+
Version = "2012-10-17"
37+
Id = "backup_reports_read_access"
38+
Statement = [
4739
{
4840
Sid = "AllowBackupReportsWrite"
4941
Effect = "Allow"
@@ -64,6 +56,24 @@ resource "aws_s3_bucket_policy" "backup_reports_bucket_policy" {
6456
})
6557
}
6658

59+
resource "aws_s3_bucket_public_access_block" "backup_reports" {
60+
bucket = aws_s3_bucket.backup_reports.id
61+
62+
block_public_acls = true
63+
block_public_policy = true
64+
ignore_public_acls = true
65+
restrict_public_buckets = true
66+
}
67+
68+
resource "aws_s3_bucket_server_side_encryption_configuration" "backup_reports" {
69+
bucket = aws_s3_bucket.backup_reports.bucket
70+
71+
rule {
72+
apply_server_side_encryption_by_default {
73+
sse_algorithm = "AES256"
74+
}
75+
}
76+
}
6777

6878
resource "aws_s3_bucket_ownership_controls" "backup_reports" {
6979
bucket = aws_s3_bucket.backup_reports.id

‎terraform/account-wide-infrastructure/test/aws-backup.tf‎

Lines changed: 32 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -3,31 +3,12 @@ resource "aws_s3_bucket" "backup_reports" { # NOSONAR (S6258) - Logging not requ
33
bucket_prefix = "${local.prefix}-backup-reports"
44
}
55

6-
resource "aws_s3_bucket_public_access_block" "backup_reports" {
7-
bucket = aws_s3_bucket.backup_reports.id
8-
9-
block_public_acls = true
10-
block_public_policy = true
11-
ignore_public_acls = true
12-
restrict_public_buckets = true
13-
}
14-
15-
resource "aws_s3_bucket_server_side_encryption_configuration" "backup_reports" {
16-
bucket = aws_s3_bucket.backup_reports.bucket
17-
18-
rule {
19-
apply_server_side_encryption_by_default {
20-
sse_algorithm = "AES256"
21-
}
22-
}
23-
}
24-
25-
resource "aws_s3_bucket_policy" "backup_reports_bucket_policy" {
6+
resource "aws_s3_bucket_policy" "backup_reports_https_only" {
267
bucket = aws_s3_bucket.backup_reports.id
278

289
policy = jsonencode({
2910
Version = "2012-10-17"
30-
Id = "backup_reports_bucket_policy"
11+
Id = "backup_reports_https_only_policy"
3112
Statement = [
3213
{
3314
Sid = "HTTPSOnly"
@@ -43,7 +24,18 @@ resource "aws_s3_bucket_policy" "backup_reports_bucket_policy" {
4324
"aws:SecureTransport" = "false"
4425
}
4526
}
46-
},
27+
}
28+
]
29+
})
30+
}
31+
32+
resource "aws_s3_bucket_policy" "backup_reports_read_access" {
33+
bucket = aws_s3_bucket.backup_reports.id
34+
35+
policy = jsonencode({
36+
Version = "2012-10-17"
37+
Id = "backup_reports_read_access"
38+
Statement = [
4739
{
4840
Sid = "AllowBackupReportsWrite"
4941
Effect = "Allow"
@@ -64,6 +56,24 @@ resource "aws_s3_bucket_policy" "backup_reports_bucket_policy" {
6456
})
6557
}
6658

59+
resource "aws_s3_bucket_public_access_block" "backup_reports" {
60+
bucket = aws_s3_bucket.backup_reports.id
61+
62+
block_public_acls = true
63+
block_public_policy = true
64+
ignore_public_acls = true
65+
restrict_public_buckets = true
66+
}
67+
68+
resource "aws_s3_bucket_server_side_encryption_configuration" "backup_reports" {
69+
bucket = aws_s3_bucket.backup_reports.bucket
70+
71+
rule {
72+
apply_server_side_encryption_by_default {
73+
sse_algorithm = "AES256"
74+
}
75+
}
76+
}
6777

6878
resource "aws_s3_bucket_ownership_controls" "backup_reports" {
6979
bucket = aws_s3_bucket.backup_reports.id

‎terraform/infrastructure/modules/firehose/s3.tf‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -3,16 +3,6 @@ resource "aws_s3_bucket" "firehose" { # NOSONAR (S6258) - Logging not required f
33
force_destroy = true
44
}
55

6-
resource "aws_s3_bucket_server_side_encryption_configuration" "firehose" {
7-
bucket = aws_s3_bucket.firehose.id
8-
rule {
9-
apply_server_side_encryption_by_default {
10-
kms_master_key_id = aws_kms_key.firehose.arn
11-
sse_algorithm = "aws:kms"
12-
}
13-
}
14-
}
15-
166
resource "aws_s3_bucket_policy" "firehose-policy" {
177
bucket = aws_s3_bucket.firehose.id
188

@@ -39,6 +29,16 @@ resource "aws_s3_bucket_policy" "firehose-policy" {
3929
})
4030
}
4131

32+
resource "aws_s3_bucket_server_side_encryption_configuration" "firehose" {
33+
bucket = aws_s3_bucket.firehose.id
34+
rule {
35+
apply_server_side_encryption_by_default {
36+
kms_master_key_id = aws_kms_key.firehose.arn
37+
sse_algorithm = "aws:kms"
38+
}
39+
}
40+
}
41+
4242
resource "aws_s3_bucket_public_access_block" "firehose-public-access-block" {
4343
bucket = aws_s3_bucket.firehose.id
4444

0 commit comments

Comments
 (0)